{"id":"ghsa-ghsa-j5rq-xfvr-p969","seq":2425,"kind":"advisory","title":"ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service","url":"https://github.com/advisories/GHSA-j5rq-xfvr-p969","permalink":"https://vulnpulse.app/items/ghsa-ghsa-j5rq-xfvr-p969","summary":"影響: npm:@apostrophecms/db-connect < 1.1.0 → 1.1.0, npm:apostrophe < 4.33.0 → 4.33.0\nSummary @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project qu…","severity":"high","techs":["nodejs","postgresql","mongodb","sqlite"],"cves":["CVE-2026-113666"],"tags":["GHSA-j5rq-xfvr-p969","@apostrophecms/db-connect","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:03:50.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}